1.1 Field of the Invention
The disclosed invention relates to the field of computing, and more particularly, to aspects of computing related to information (data) segregation upon portable computing devices.
1.2 The Related Art
With the advent of a wide variety of portable computing devices, such as PDAs and smart phones, especially those owned by employees but used for business purposes, control over applications and information stored on portable computing devices has become more difficult for central information technology (“IT”) departments. Many employees desire to use their own devices in performing their jobs for a number of reasons, including: the greater merging of work and home lives leading to a need to include both personal and work-related information on a single device to avoid using multiple devices (e.g., having two cell phones or PDAs), the higher degree of technical sophistication of the employee and their greater independence from the IT department, and the increasing use of technology as a means of self-expression. The trend towards “BYOD” (“bring your own device”) creates a challenge for IT departments, not only for maintaining multiple device types and manufacturers, but for protecting sensitive data and access to data on secure servers.
Application programs use typically involves one or more types of data, such as configuration settings for the application, data to be manipulated or used by the application, or output from the application. (The term “data” is used herein to refer to any or all types of information associated with a specific application instance.) Regardless of ownership, portable computing devices often have a mix of enterprise and personal applications and information. It is difficult to maintain separation between enterprise information and personal information. In some cases, a portable computing device may also contain applications and information belonging to other entities, such as clubs, volunteer organizations, schools, etc. Therefore, it would be useful to have a mechanism that can establish and manage segregated application and information “domains” on portable computing devices, each such segregated domain encompassing a defined set of applications and information accessible within that domain; the domain being further associated with domain-specific policies as required for control over the applications and information that is part of the segregated domain.
Application programs (“apps”) are typically run as “processes” on portable computing devices. Apps can be assigned various levels of resource usage, such as processor time or memory, by an operating system (OS) on the portable computing device. Applications call upon the OS or service daemons to provide various functions, such as access to data files or peripheral devices, network connections, inter-process communication, allocation of resources, etc. On some portable computing devices, these calls make direct reference to the OS. In other portable computing devices, these calls are made through dynamic or statically loaded library function calls, service processes, or other well-known methods. Applications running on portable computing devices may have OS-level protections applied to them (when these protections exist for the portable computing device). These OS-level protections provide access-controls to specific resource. These protections do not limit how applications can share information (they limit access, not usage), or how the data can be communicated and/or stored.
Some portable computing devices utilize virtualization technologies in which applications and data is segregated into disparate virtual machines. Applications implemented using virtualization techniques are isolated from each other and are unable to communicate and/or share information. In many cases, however, some level of sharing is desired, and virtualization does not provide a solution when information needs to be shared.
Even when a portable computing device has the capability to be configured so as to maintain applications and data separately, the problem of control of owned data is not solved. The application can only enforce required policies on the data for itself, while it is running. It can not prevent other applications from treating the data in ways that violate the data owner's policies, especially when it is not running. Application enforcement of owner policies is not persistent, or pervasive, and is therefore inadequate. For example, if a Post Office Protocol (POP) e-mail client were written to keep messages received from a first mail server separate from those received from a second mail server, and to permit forwarding of a message only through the mail server it was received from, there may be nothing to prevent a different e-mail client or a file transfer application from sending the stored messages or message files to a third server. Policy enforcement must be persistent and pervasive to be effective.
Current portable computing devices do not:
Recognize a plurality of owners of the applications and data stored on the device,
Provide for a combination of external and locally provided policy to define application and information segregation,
Segregate applications and information in accordance with policy-defined control definitions,
Provide mechanisms for persistent controls over applications and information subject to policy control,
Provide mechanisms for fine-grained control over operations by and between applications operating on the device.
This combination of portable computing device attributes is not currently available. What is needed is a computing solution that isolates application information and provides distinct improvements over existing portable computing device architectures by dynamically enabling a plurality of policy controlled “domains”, each comprising one or more applications and its information. The present invention meets these and other needs.